Vulnerability · Published Sep 11, 2026 · Assigned by VulnCheck

CVE-2026-89260MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint

High 7.5

In plain English

A high-severity XML external entity in MoguBlog from moxi624. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.7%top 45.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.

Affected products (as reported)

Vendor	Product	Versions
moxi624	MoguBlog	0 – through 6.2

Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

C10 - POST /wechat/wechatCheck unauthenticated XXE proof of concept exploit
SignUtil.xmlToMap builds an unhardened dom4j SAXReader technical-description
WechatRestApi POST /wechatCheck parses the body without verifying the signature technical-description
MoguBlog releases release-notes
Product product
VulnCheck Advisory: MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint third-party-advisory